We published a new dataset built from CERT-FR security bulletins: CIRCL/Vulnerability-CERT-FR. It’s the French counterpart of our Chinese (CNVD) and Russian (FSTEC) datasets. Its goal is to train a VLAI severity classifier for French text. (VulnTrain#24)
This work was carried out during the Hack.Lu 2026 hackathon.
The problem: bulletins have no severity
CERT-FR alerts (alertes) and advisories (avis) don’t include a severity rating. They do usually list the CVEs they cover, so we label each bulletin from the CVSS scores of its linked CVEs.
We started from all bulletins available in Vulnerability-Lookup:
- 18,128 bulletins since 2000, including the earlier CERTA bulletins: 398 alertes and 17,730 avis.
- 101,544 unique CVEs referenced. Only 3.6% of them have no CVSS score at all.
Maximum rather than mean
A bulletin often covers several CVEs, so their scores have to be combined into one. We chose the highest score:
- It matches the text. Summaries name the worst impact (“permettent à un attaquant de provoquer une exécution de code arbitraire à distance…”), and the list of risks is the union of all impacts.
- The mean dilutes the worst case. For example, CERTFR-2026-ALE-007 (WordPress) has a maximum of 9.8 (Critical) but a mean of 7.9 (High). An alert about a 9.8 remote code execution shouldn’t be labelled High. Across the dataset, the mean turns about half of the Critical bulletins into High or Medium.
The mean is still stored in the dataset, in case someone wants to compare.
Keeping bulletins with 1 to 10 CVEs
The maximum stops meaning much on large bulletins. Some avis are vendor patch roll-ups (Oracle, Cisco, Splunk…) referencing over 100 CVEs, up to 353. Their maximum is almost always Critical, whatever the text says. Among avis that reference CVEs:
- 70% reference 8 CVEs or fewer (median 3).
- Keeping N ≤ 10 retains about 75% of the avis with scored CVEs.
- Above 10, each additional bulletin mostly adds a Critical label. Going from N ≤ 10 to no limit raises Critical from 2,885 to 5,005, while Medium barely moves (2,749 to 2,797).
We also require a score for at least 80% of a bulletin’s CVEs, and a non-empty summary. The score filter removes very few bulletins. The summary filter removes about 190 old bulletins.
CVSS v2
Before 2016, most CVEs only have a CVSS v2 score, which has no Critical rating. Applying the v3 thresholds to them would inflate the Critical class. Instead of choosing for everyone, we keep these bulletins and flag them (v2_only). Each trainer can then exclude them, use the v2 ratings, or treat t800 bulletins are v2-only.
When a CVE has several scores, we use v3.1 first,ores come from the CNA record, or from NVD when the CNA has none.
Result
10,435 bulletins: 10,177 avis and 258 alertes. Alertes are too few to make a dataset of their own, so they’re merged with the
avis and marked by the source field.
Severity (cvss_max) |
All bulletins | Excludi |
|---|---|---|
| Low | 205 (2.0%) | 79 (1.2%) |
| Medium | 2,702 (25.9%) | 1,321 (19.5%) |
| High | 4,549 (43.6%) | 3,620 (53.4%) |
| Critical | 2,979 (28.5%) | 1,760 (26.0%) |
Each row contains:
- the title, the summary (with HTML and Markdown removed) and the list of risks identified by CERT-FR;
- the publication date;
- the linked CVEs, with each CVE’s score and CVSS version;
cvss_max,cvss_meanand thev2_onlyflag.
The “solutions” part of the bulletins is left out"Se référer au bulletin de sécurité del’éditeur…").
Caveats
- The label is an approximation. It’s the severity of the worst CVE in the bulletin, not an assessment by CERT-FR.
- Low is very rare (about 1–2%).
- Summaries are often templated (“De multiples vulnérabilités ont été découvertes dans…”). Splits for training should be
deduplicated on the text.
The dataset is generated with vulntrain-dataset-lerte,certfr_avis. Labelling choices are
documented in the dataset card and in VulnTrain’s docs/publishing.md.
The French severity classifier is in progress; we’ll post results once it’s trained.